The short answer: not much without additional information
A hacker cannot drain your bank account using only your account number and routing number. Those two pieces of information alone are not enough to transfer money out or make purchases. However, they can be used as part of a larger fraud scheme, and you should treat them as sensitive information you do not share casually.
Your account and routing numbers are designed to be semi-public. You write them on checks, give them to employers for direct deposit, and provide them to billers for automatic payments. Banks expect these numbers to be seen by third parties. What makes fraud possible is combining them with other information or using them in specific ways that bypass your bank's security checks.
Key Takeaways
- Account and routing numbers alone cannot be used to withdraw money or make charges without additional steps or information.
- A fraudster can set up unauthorized automatic payments or ACH transfers if they also have your name and address.
- Your bank's fraud detection systems are designed to catch unauthorized activity, and you have legal protection against most unauthorized transfers.
- If you suspect fraud, contact your bank immediately and report it in writing within 60 days to preserve your legal protections.
- Monitoring your statements regularly is the fastest way to catch unauthorized activity before significant damage occurs.
What a fraudster can do with account and routing numbers
The main risk is ACH fraud — setting up unauthorized automatic transfers or payments using your account information. ACH stands for Automated Clearing House, the system that processes direct deposits, bill payments, and transfers between accounts. If someone has your account number, routing number, name, and address, they can attempt to initiate an ACH debit (a pull of money from your account) to themselves or to a third party.
This is different from a debit card or credit card fraud, where a criminal uses card details to make immediate purchases. ACH fraud is slower but can move larger amounts. The fraudster submits a request to move money from your account to theirs, usually through a third-party payment processor or by posing as a business collecting a payment.
A second risk is check fraud. If someone has your account and routing number, they can print counterfeit checks or order checks in your name and use them to withdraw cash or pay for goods. This is why some people treat their account and routing numbers as carefully as they treat their Social Security number.
Why banks can still stop unauthorized transfers
Banks have multiple layers of fraud detection. When an ACH debit hits your account, the bank's system checks whether the amount, timing, and destination match your normal activity. A sudden large transfer to an unfamiliar account will often be flagged and held for review. The bank may contact you to confirm before processing.
Additionally, the ACH system itself has rules. The originating bank (the one sending the money) is required to verify that the person initiating the transfer has authority to do so. If a fraudster tries to set up an ACH debit from your account without your permission, the originating bank's compliance team may catch it during their verification process, especially if the request comes from an unusual source or pattern.
You also have legal protection. Under the Electronic Funds Transfer Act (EFTA), you are not liable for unauthorized electronic transfers if you report them within 60 days of the statement date. If you report within two business days, your liability is capped at $50. If you wait longer, your liability can be higher, but the bank still bears responsibility for proving the transfer was authorized.
How fraudsters actually get your account and routing numbers
Most account and routing number theft happens through data breaches at companies that store this information — payroll processors, payment platforms, healthcare providers, or retailers. Criminals buy stolen databases on the dark web and attempt bulk ACH fraud, knowing that some percentage will succeed before being caught.
Phishing is another common route. A fraudster sends you an email or text posing as your bank, asking you to "verify" your account information. They may claim there is suspicious activity or that you need to update your details. If you click and enter your information, they now have it.
Social engineering is a third method. A fraudster calls your bank pretending to be you, or calls a business where you work claiming to be from the bank, and tricks someone into revealing your account details. This is less common but happens.
Dumpster diving and mail theft are older methods but still occur. Fraudsters search trash for discarded bank statements or intercept mail containing checks or account information.
What to do if you think your account number has been compromised
Contact your bank immediately by phone using the number on the back of your debit card or on your bank statement — not a number from an email or text message. Tell them you believe your account information has been compromised and ask them to flag your account for fraud monitoring.
Request that your bank issue you a new account number. Most banks can do this within one to three business days. You will receive a new debit card and new checks, and any automatic payments you have set up will need to be updated with the new number.
Review your recent statements carefully for any unauthorized transactions. Look for small test charges (fraudsters often make a small charge first to confirm the account is active) and larger transfers you do not recognize. Report any unauthorized activity to your bank in writing within 60 days of the statement date. Keep copies of your written report.
If the breach came from a specific company — a retailer, employer, or service provider — check whether they have issued a public notice and whether they offer credit monitoring or fraud protection as part of their response. Some breaches trigger free credit monitoring for affected customers.
Protecting your account and routing numbers going forward
Treat your account and routing numbers like you would treat other financial information. Do not share them in response to unsolicited calls, emails, or texts. Your bank will never ask for these numbers via email or text.
When you do need to provide them — to set up direct deposit, pay a bill, or send a wire — verify you are communicating with a legitimate business. Call the company using a phone number from their official website, not from an email they sent you.
Use strong, unique passwords for your online banking account. Enable multi-factor authentication if your bank offers it. This adds a second verification step (usually a code sent to your phone) when you or anyone else tries to log in.
Monitor your bank statements regularly, ideally weekly. Many banks offer text or email alerts when transactions above a certain amount occur. Set up alerts for your account so you are notified of large transfers or unusual activity in real time.
Shred documents containing your account information before throwing them away. If you move or close an account, ask your bank what happens to old checks and statements.
Frequently Asked Questions
Can someone open a new bank account in my name using my account and routing number?
No. Opening a new account requires identity verification — a government ID, Social Security number, and proof of address. Your account and routing numbers alone are not enough. However, if a fraudster has your full name, address, and Social Security number, they could attempt to open an account by impersonating you, which is identity theft rather than account number theft.
What if I see a small charge I do not recognize on my statement?
Report it to your bank immediately. Fraudsters often make small test charges ($1 to $5) to confirm an account is active before attempting larger transfers. Catching and reporting these early can prevent bigger fraud. Your bank can reverse the charge and investigate the source.
Do I need to close my account if my routing number was exposed?
Not necessarily. Your routing number is the same for all customers at your bank and is not secret — it is printed on every check. Your account number is what matters. If only your routing number was exposed, the risk is low. If your account number was exposed, ask your bank about issuing a new account number.
How long does it take to get a new account number?
Most banks can issue a new account number within one to three business days. You will receive a new debit card and checks in the mail, which usually takes five to ten business days. During this time, your old account remains active but flagged for monitoring. You will need to update any automatic payments or direct deposits with your new account number.
Am I responsible for paying back unauthorized ACH transfers?
No, not if you report them within 60 days. Under federal law, you are protected from liability for unauthorized electronic transfers. Report the fraud to your bank in writing and keep a copy. The bank must investigate and return the money to your account while they do.